Firstly, we have to implement authentication.

The user application component manages the user authentication status. It requires us to specify an identity class which contains the actual authentication logic.

return [
    'components' => [
        'user' => [
            'identityClass' => 'app\models\User',
        ],
    ],
];